Minor documentation updates (#3187)

* Fix typos in Advanced Usage.

* Fix spelling mistakes, add notes about native types in migration guide.

* Update comment and variable name in trust extension.

* Add note about not using the `URLSession` to interact with tasks.

* Latest formatting.

* Update indentation.

* Add note about disabling trust evaluation.

Documentation/AdvancedUsage.md

@@ -132,7 +132,7 @@ let session = Session(configuration: configuration)
 A `SessionDelegate` instance encapsulates all handling of the various `URLSessionDelegate` and related protocols callbacks. `SessionDelegate` also acts as the `SessionStateDelegate` for every `Request` produced by Alamofire, allowing the `Request` to indirectly import state from the `Session` instance that created them. `SessionDelegate` can be customized with a specific `FileManager` instance, which will be used for any disk access, like accessing files to be uploaded by `UploadRequest`s or files downloaded by `DownloadRequest`s.
 
 ```swift
-let delelgate = SessionDelegate(fileManager: .default)
+let delegate = SessionDelegate(fileManager: .default)
 ```
 
 ### `startRequestsImmediately`
@@ -649,9 +649,9 @@ The `ServerTrustManager` is responsible for storing an internal mapping of `Serv
 ```swift
 let evaluators: [String: ServerTrustEvaluating] = [
     // By default, certificates included in the app bundle are pinned automatically.
-    "cert.example.com": PinnedCertificatesTrustEvalutor(),
+    "cert.example.com": PinnedCertificatesTrustEvaluator(),
     // By default, public keys from certificates included in the app bundle are used automatically.
-    "keys.example.com": PublicKeysTrustEvalutor(),
+    "keys.example.com": PublicKeysTrustEvaluator(),
 ]
 
 let manager = ServerTrustManager(evaluators: serverTrustPolicies)

Documentation/Alamofire 5.0 Migration Guide.md

@@ -29,21 +29,22 @@ Most APIs have changed in Alamofire 5, so this list is not complete. While most
 - Global `Alamofire` namespace usage, which was never really necessary, has been removed and replaced with a single `AF` reference to `Session.default`.
 - `ServerTrustPolicyManager` has been renamed `ServerTrustManager` and now requires every evaluated request to match one of the provided hosts. This can be disabled by initializing an instance with `allHostsMustBeEvaluted: false`.
 - `ServerTrustPolicy` has be separated into a protocol, `ServerTrustEvaluating`, and several conforming types. Each case of `ServerTrustPolicy` now has equivalent types:
-	- `.performDefaultEvaluation` is replaced by `DefaultTrustEvaluator`.
-	- `.performRevokedEvaluation	` is replaced by `RevocationTrustEvaluator`.
-	- `.pinCertificates` is replaced by `PinnedCertificatesTrustEvaluator`.
-	- `.pinPublicKeys` is replaced by `PublicKeysTrustEvaluator`.
-	- `.disableEvaluation` is replaced by `DisabledTrustEvaluator`.
-	- `.customEvaluation` is replaced by either using `CompositeTrustEvalutor` to combine existing `ServerTrustEvaluating` types or by creating a new type that conforms to `ServerTrustEvaluating`.
+  - `.performDefaultEvaluation` is replaced by `DefaultTrustEvaluator`.
+  - `.performRevokedEvaluation` is replaced by `RevocationTrustEvaluator`.
+  - `.pinCertificates` is replaced by `PinnedCertificatesTrustEvaluator`.
+  - `.pinPublicKeys` is replaced by `PublicKeysTrustEvaluator`.
+  - `.disableEvaluation` is replaced by `DisabledTrustEvaluator`.
+  - `.customEvaluation` is replaced by either using `CompositeTrustEvalutor` to combine existing `ServerTrustEvaluating` types or by creating a new type that conforms to `ServerTrustEvaluating`.
 - `DataResponse` and `DownloadResponse` are now both doubly generic to both the response type as well as the error type. By default all Alamofire APIs return a `AF` prefixed response type, which defaults the `Error` type to `AFError`.
 - Alamofire now returns `AFError` for all of its APIs, wrapping any underlying system or custom APIs in `AFError` instances.
 - `HTTPMethod` is now a `struct` and not an `enum` and can be expanded to provide custom methods.
+- `HTTPHeaders` and other types are now native Swift types rather than `typealias`es, so care must be taken when passing them to Obj-C bridged collections.
 - `AFError` now has several new cases, so switching over it exhaustively will have to be updated.
 - `Notification`s provided by Alamofire have had their keys renamed. You can now subscribe to:
-	- `Request.didResumeNotification` and `Request.didResumeTaskNotification` to be notified when `Request`s and their `URLSessionTask`s have `resume()` called.
-	- `Request.didSuspendNotification` and `Request.didSuspendTaskNotification` to be notified when `Request`s and their `URLSessionTask`s have `suspend()` called.
-	- `Request.didCancelNotification` and `Request.didCancelTaskNotification` to be notified when `Request`s and their `URLSessionTask`s have `cancel()` called.
-	- `Request.didFinishNotification` and `Request.didCompleteTaskNotification` to be notified when `Request`s have `finish()` called and when `URLSessionTask`s trigger the `didComplete` delegate method.
+  - `Request.didResumeNotification` and `Request.didResumeTaskNotification` to be notified when `Request`s and their `URLSessionTask`s have `resume()` called.
+  - `Request.didSuspendNotification` and `Request.didSuspendTaskNotification` to be notified when `Request`s and their `URLSessionTask`s have `suspend()` called.
+  - `Request.didCancelNotification` and `Request.didCancelTaskNotification` to be notified when `Request`s and their `URLSessionTask`s have `cancel()` called.
+  - `Request.didFinishNotification` and `Request.didCompleteTaskNotification` to be notified when `Request`s have `finish()` called and when `URLSessionTask`s trigger the `didComplete` delegate method.
 - `MultipartFormData`’s API has changed and the top level `upload` methods to create and upload `MultipartFormData` have been updated to match other request APIs, so it’s not longer necessary to deal with the `Result` of the multipart encoding.
 - `NetworkReachabilityManager` has been refactored for greater reliability and simplicity. Instead of setting an update closure and then starting the listener, the closure is provided to the `startListening` method.
 - `Request` and its various subclasses have been rewritten and the public API completely changed. Please see the documentation for an exhaustive list of the current functionality.

Source/ServerTrustEvaluation.swift

@@ -334,12 +334,19 @@ public final class CompositeTrustEvaluator: ServerTrustEvaluating {
 
 /// Disables all evaluation which in turn will always consider any server trust as valid.
 ///
+/// - Note: Instead of disabling server trust evaluation, it's a better idea to configure systems to properly trust test
+///         certificates, as outlined in [this Apple tech note](https://developer.apple.com/library/archive/qa/qa1948/_index.html).
+///
 /// **THIS EVALUATOR SHOULD NEVER BE USED IN PRODUCTION!**
 @available(*, deprecated, renamed: "DisabledTrustEvaluator", message: "DisabledEvaluator has been renamed DisabledTrustEvaluator.")
 public typealias DisabledEvaluator = DisabledTrustEvaluator
 
 /// Disables all evaluation which in turn will always consider any server trust as valid.
 ///
+///
+/// - Note: Instead of disabling server trust evaluation, it's a better idea to configure systems to properly trust test
+///         certificates, as outlined in [this Apple tech note](https://developer.apple.com/library/archive/qa/qa1948/_index.html).
+///
 /// **THIS EVALUATOR SHOULD NEVER BE USED IN PRODUCTION!**
 public final class DisabledTrustEvaluator: ServerTrustEvaluating {
     /// Creates an instance.
@@ -485,10 +492,10 @@ public extension AlamofireExtension where ExtendedType == SecTrust {
                                                                                                certificates: certificates))
         }
 
-        // Reenable system anchor certificates.
-        let systemStatus = SecTrustSetAnchorCertificatesOnly(type, true)
-        guard systemStatus.af.isSuccess else {
-            throw AFError.serverTrustEvaluationFailed(reason: .settingAnchorCertificatesFailed(status: systemStatus,
+        // Trust only the set anchor certs.
+        let onlyStatus = SecTrustSetAnchorCertificatesOnly(type, true)
+        guard onlyStatus.af.isSuccess else {
+            throw AFError.serverTrustEvaluationFailed(reason: .settingAnchorCertificatesFailed(status: onlyStatus,
                                                                                                certificates: certificates))
         }
     }

Source/Session.swift

@@ -33,6 +33,10 @@ open class Session {
 
     /// Underlying `URLSession` used to create `URLSessionTasks` for this instance, and for which this instance's
     /// `delegate` handles `URLSessionDelegate` callbacks.
+    ///
+    /// - Note: This instance should **NOT** be used to interact with the underlying `URLSessionTask`s. Doing so will
+    ///         break internal Alamofire logic that tracks those tasks.
+    ///
     public let session: URLSession
     /// Instance's `SessionDelegate`, which handles the `URLSessionDelegate` methods and `Request` interaction.
     public let delegate: SessionDelegate